commands/sysadmin/linux-desktop/ssh/manage-ssh-keys.md

metadata

description: Review installed SSH key pairs and delete old ones if desired
tags:
  - ssh
  - security
  - keys
  - configuration
  - project
  - gitignored

You are helping the user manage their SSH keys.

Process

1. List SSH keys

   • List keys in ~/.ssh/: ls -la ~/.ssh/
   • Identify key pairs:
     • Private keys (no extension, or .pem)
     • Public keys (.pub)
     • Known hosts file
     • Config file

2. Display public keys with details

   • For each public key:

     for key in ~/.ssh/*.pub; do
       echo "=== $key ==="
       ssh-keygen -l -f "$key"
       echo ""
     done
     

   • Shows: key length, fingerprint, comment

3. Check if keys are loaded in ssh-agent

   • List loaded keys: ssh-add -l
   • If agent not running: eval "$(ssh-agent -s)"

4. Identify key usage

   • Check ~/.ssh/config for key assignments
   • Ask user about each key:
     • Where is it used? (GitHub, servers, etc.)
     • Is it still needed?
     • When was it created?

5. Check key security

   • Verify key types (RSA, ED25519, etc.)
   • Check key lengths:
     • RSA: Minimum 2048-bit, prefer 4096-bit
     • ED25519: 256-bit (modern, recommended)
   • Suggest upgrading old/weak keys

6. Delete old/unused keys

   • For each key user wants to remove:

     rm ~/.ssh/old_key
     rm ~/.ssh/old_key.pub
     

   • Update ~/.ssh/config if key was referenced
   • Remove from ssh-agent: ssh-add -d ~/.ssh/old_key

7. Generate new keys if needed

   • Suggest ED25519 for new keys:

     ssh-keygen -t ed25519 -C "user@email.com"
     

   • Or RSA 4096:

     ssh-keygen -t rsa -b 4096 -C "user@email.com"
     

8. Update permissions

   • Ensure correct permissions:

     chmod 700 ~/.ssh
     chmod 600 ~/.ssh/id_*
     chmod 644 ~/.ssh/id_*.pub
     chmod 600 ~/.ssh/config
     

9. Add keys to ssh-agent

   • Add keys: ssh-add ~/.ssh/id_ed25519
   • Persist across reboots (add to ~/.bashrc):

     eval "$(ssh-agent -s)"
     ssh-add ~/.ssh/id_ed25519
     

Output

Provide a summary showing:

• List of SSH keys with details (type, length, fingerprint)
• Keys currently loaded in ssh-agent
• Keys deleted (if any)
• New keys generated (if any)
• Security recommendations
• Next steps for adding keys to services